multicz

Multi-component versioning for monorepos.

Bump a Python app, its Docker image, and the Helm chart that deploys it from a single conventional-commit history - each with its own version line and its own git tag.

multicz demo

Install

uv tool install multicz   # or: pipx install multicz / pip install multicz

Quickstart

# 1. scaffold a multicz.toml in the repo root
multicz init

# 2. see what would bump from the current commit window
multicz changed
multicz explain api

# 3. apply the bump (writes version files + changelog, commits, tags)
multicz bump --commit --tag

# 4. ship it
git push --follow-tags

For multi-component setups (api + chart, app + image + helm, ...), declare each component's paths in multicz.toml and let mirrors and triggers cascade related versions. See the docs for the full configuration reference.

What it does

Per-component versions - each component has its own version line and its own git tag (api-v1.2.0, chart-v0.5.0).
Conventional-commit driven - feat: → minor, fix: → patch, BREAKING CHANGE: → major. Scopes route the bump to the right component.
Mirrors and triggers - bump api 1.2.0 → 1.3.0 and the Helm chart's appVersion follows; the chart's own version cascades a patch.
No network, no auto-updates. Pure git + filesystem. Same input yields the same plan byte-for-byte.

Documentation

Published at https://goabonga.github.io/multicz/:

Get started - install, minimal config, first bump
Concepts - components, mirrors, triggers, cascades, bump policies
Configuration - full multicz.toml reference
CLI - every command and flag
Recipes - FastAPI + Helm walkthrough, CI matrix gating, release candidates
Why multicz? - vs. semantic-release, Commitizen, Changesets, bump-my-version
Security - guarantees and CI hardening

License

MIT

Metadata

Release files for multicz 1.7.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for multicz 1.7.0
File	Size	Uploaded	Provenance
multicz-1.7.0.tar.gz	95.1 kB	Oct 2, 2026	With provenance	Details

Built distribution (wheel)

Table of built distributions (wheels) for multicz 1.7.0
File	Interpreter	ABI	Platform	Reset
multicz-1.7.0-py3-none-any.whl 142.8 kB Oct 2, 2026 With provenance	Python 3	none	any	Details

Total release size: 237.9 kB

Release files / multicz-1.7.0.tar.gz

Download URL	multicz-1.7.0.tar.gz
Size	95.1 kB
Tags	Source
SHA-256 checksum How to use checksums	`ef77d30dcc28492479782672b2d86bc9c5583b8a15f5e1b81b077731e33ada53`
BLAKE2b-256 checksum How to use checksums	`09596f824f46382f46cbddd1377bec676be75f90f9960455ac0b27cf7d2c62d9`
Upload date	Oct 2, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/goabonga/multicz
Publishing commit: github.com/goabonga/multicz/tree/4c11c8b673caa7c174f525f3dc9dc9e4ab3a53b2

Workflow

Publishing configuration: github.com/goabonga/multicz/blob/4c11c8b673caa7c174f525f3dc9dc9e4ab3a53b2/.github/workflows/release.yml
Publishing logs: github.com/goabonga/multicz/actions/runs/37012127340/attempts/1

Artifact

Subject: multicz-1.7.0.tar.gz
SHA-256 checksum: ef77d30dcc28492479782672b2d86bc9c5583b8a15f5e1b81b077731e33ada53 Verifying attestations

Release files / multicz-1.7.0-py3-none-any.whl

Download URL	multicz-1.7.0-py3-none-any.whl
Size	142.8 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`e1764053108607f4700c8296ee8a603ef1937108bf667d51cdad6e88ec09cd2a`
BLAKE2b-256 checksum How to use checksums	`952c6ff6cd9fd78cd54d4a085d7bc9de9e5ef7c752edf1106a63ae1b8477a327`
Upload date	Oct 2, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/goabonga/multicz
Publishing commit: github.com/goabonga/multicz/tree/4c11c8b673caa7c174f525f3dc9dc9e4ab3a53b2

Workflow

Publishing configuration: github.com/goabonga/multicz/blob/4c11c8b673caa7c174f525f3dc9dc9e4ab3a53b2/.github/workflows/release.yml
Publishing logs: github.com/goabonga/multicz/actions/runs/37012127340/attempts/1

Artifact

Subject: multicz-1.7.0-py3-none-any.whl
SHA-256 checksum: e1764053108607f4700c8296ee8a603ef1937108bf667d51cdad6e88ec09cd2a Verifying attestations

Security for multicz 1.7.0

Report project as malware

Provenance

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Attestation for multicz-1.7.0.tar.gz

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/goabonga/multicz
Publishing commit: github.com/goabonga/multicz/tree/4c11c8b673caa7c174f525f3dc9dc9e4ab3a53b2

Workflow

Publishing configuration: github.com/goabonga/multicz/blob/4c11c8b673caa7c174f525f3dc9dc9e4ab3a53b2/.github/workflows/release.yml
Publishing logs: github.com/goabonga/multicz/actions/runs/37012127340/attempts/1

Artifact

Subject: multicz-1.7.0.tar.gz
SHA-256 checksum: ef77d30dcc28492479782672b2d86bc9c5583b8a15f5e1b81b077731e33ada53 Verifying attestations

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.